# Dokumentasi CLI Niznet OS 0.9.0

Dokumen ini berisi panduan CLI (bagian 1-10) dan referensi lengkap setiap menu dan perintah (Lampiran). Referensi ditulis dalam bahasa Inggris, sama dengan teks yang dicetak router.

Berlaku untuk NR642, NAP612, dan vNR. NR451 (Niznet Lite) tidak memiliki CLI; semua pengaturannya dilakukan lewat WebUI.

## 1. Apa itu CLI Niznet

CLI (command-line interface) Niznet adalah cara mengatur router Niznet dengan mengetik perintah, lewat koneksi **SSH** dari komputer Anda. CLI berisi **pengaturan yang sama dengan WebUI**, disusun dalam **menu yang sama**: Internet, Jaringan Lokal, Wi-Fi, Firewall, VPN, Hotspot, Routing, Monitoring, dan Sistem. Jika Anda sudah tahu letak sebuah pengaturan di WebUI, Anda sudah tahu letaknya di CLI.

CLI cocok untuk Anda yang:

- mengelola banyak router dan ingin bekerja lebih cepat dengan keyboard,
- ingin melihat seluruh konfigurasi dalam bentuk teks,
- perlu menjalankan satu perintah dari script, misalnya untuk pemantauan.

**Model yang memiliki CLI**

| Model | Jenis | CLI |
|---|---|---|
| **NR642** | Router Wi-Fi | Ada |
| **NAP612** | Access point plafon | Ada |
| **vNR** | Router virtual (berjalan di server atau mesin virtual) | Ada (tanpa menu Wi-Fi, karena tidak memiliki radio) |
| **NR451** (Niznet Lite) | Router Wi-Fi ringkas | **Tidak ada.** Semua pengaturan NR451 dilakukan lewat WebUI. |

CLI dan WebUI memakai **satu konfigurasi yang sama**. Perubahan dari CLI langsung terlihat di WebUI, dan sebaliknya.

## 2. Masuk ke CLI

### Yang Anda perlukan

- Komputer yang terhubung ke jaringan router (kabel LAN atau Wi-Fi).
- Program SSH. Di Windows 10/11, macOS, dan Linux, perintah `ssh` sudah tersedia di Terminal / PowerShell. Anda juga bisa memakai PuTTY.
- Alamat IP router:
  - **NR642:** alamat bawaannya **192.168.45.1**.
  - **NAP612:** mengambil alamat dari DHCP server di jaringan Anda - lihat di daftar klien DHCP router utama (nama host `nap612-xxxx`). Jika tidak ada DHCP server, misalnya laptop disambung langsung, NAP612 memakai **192.168.112.1** setelah sekitar 15 detik; beri laptop alamat tetap, misalnya 192.168.112.10/24.
  - **vNR:** mengambil alamat dari DHCP di jaringan tempat ia dipasang; lihat alamatnya di daftar lease DHCP jaringan itu, atau masuk lewat konsol hypervisor. Tanpa DHCP, vNR memakai 169.254.45.1. vNR yang dipasang di VPS memakai alamat VPS itu sendiri.

### Masuk dengan akun pemilik

Masuk dengan **akun pemilik router** - akun yang sama dengan yang Anda pakai untuk masuk ke WebUI. Nama akun bawaan adalah `niznet`.

```
ssh niznet@192.168.45.1
```

Ganti `192.168.45.1` dengan alamat router Anda, dan `niznet` dengan nama akun Anda jika sudah Anda ubah.

**Catatan:** Akun lain yang dibuat di WebUI (menu Sistem → Pengguna) juga dapat masuk ke CLI dengan nama dan kata sandinya sendiri. Akun yang sudah ada sebelum update ke 0.9.0 baru bisa masuk ke CLI setelah kata sandinya diatur ulang sekali di WebUI. Akun dengan peran hanya-baca dapat melihat, tetapi tidak dapat mengubah pengaturan atau me-reboot router.

### Pertama kali masuk: ganti kata sandi bawaan

Router baru (atau router yang baru di-reset) masih memakai login bawaan pabrik: nama `niznet`, kata sandi `niznet`. Login ini sama di semua unit dan tercantum di dokumentasi, jadi **router meminta Anda menggantinya sebelum melakukan apa pun**. Ini juga berlaku jika Anda masuk pertama kali lewat CLI, bukan lewat WebUI.

Yang akan Anda lihat:

1. Pesan bahwa unit masih memakai login bawaan.
2. Ketentuan lisensi, lalu pertanyaan apakah Anda menyetujuinya. Ketik `y` untuk setuju.
3. Permintaan kata sandi saat ini (`niznet`), lalu kata sandi baru **dua kali**. Ketikan tidak ditampilkan di layar - itu normal.

```
This unit still has the login it shipped with. Every unit has it and it is
published in the documentation, so it is changed before anything else.

...(ketentuan lisensi)...

Do you accept these licence terms (version ...)? [y/N]: y
Current password (the one you logged in with):
New password:
New password again:
The password is changed: SSH and the WebUI take the new one from now on.
```

Kata sandi baru minimal **12 karakter** dan tidak boleh sama dengan kata sandi bawaan. Kata sandi baru langsung berlaku untuk SSH **dan** WebUI. Jika Anda menjawab tidak, atau menekan Ctrl-C, Anda keluar dan tidak ada yang berubah.

**Catatan:** Penggantian kata sandi pertama harus dilakukan di terminal biasa. Perintah satu baris dari script (lihat FAQ) ditolak sampai kata sandi bawaan diganti.

### Tampilan setelah masuk

Setelah masuk, router menampilkan logo Niznet, versi sistem, model, dan nama router, lalu prompt:

```
  Niznet OS 0.9.0
  ...

  Model:     NR642
  Identity:  nr642-1a2b

  Type ? for help, Tab to complete.
  Commit mode: immediate - each change is committed as you type it.

[niznet@nr642-1a2b] >
```

Prompt menunjukkan **siapa Anda** dan **router mana** yang sedang Anda atur: `[akun@nama-router] >`. Saat Anda berada di dalam sebuah menu, namanya ikut tampil:

```
[niznet@nr642-1a2b] /internet uplinks>
```

Di semua contoh di halaman ini, Anda cukup mengetik bagian **setelah** tanda `>`.

### Pilihan: masuk hanya dengan kunci SSH

Agar lebih aman, Anda dapat mematikan login SSH dengan kata sandi dan hanya mengizinkan kunci SSH:

1. Tambahkan kunci publik SSH Anda di **WebUI**, menu Sistem → tab Pengaturan, bagian **SSH key** (tombol **Tambah SSH key**). (Menambah kunci belum bisa dilakukan dari CLI di versi 0.9.0.)
2. Pastikan Anda bisa masuk dengan kunci tersebut.
3. Lalu di CLI:

```
/system settings set ssh-key-only=yes
```

**Penting:** lakukan langkah 2 dulu. Jika kunci Anda belum terpasang, Anda tidak bisa masuk lagi lewat SSH (WebUI tetap bisa dipakai). Kunci SSH berlaku untuk akun pemilik; setelah `ssh-key-only=yes`, akun lain tidak bisa lagi masuk ke CLI lewat SSH.

## 3. Menu dan cara berpindah

### Menu utama

Menu CLI mengikuti menu di sidebar WebUI, dengan urutan yang sama.

| Menu CLI | Di WebUI | Isinya |
|---|---|---|
| `/internet` | Internet | uplink, port LAN/WAN, bandwidth (QoS) |
| `/local-network` | Jaringan Lokal | interface, bridge, VLAN, DHCP, DNS |
| `/wifi` | Wi-Fi | radio, jaringan Wi-Fi (SSID), klien yang terhubung |
| `/firewall` | Firewall | zona, aturan, port forwarding, filter web |
| `/vpn` | VPN | WireGuard, OpenVPN, IPsec, SSTP, PPTP, SD-WAN |
| `/hotspot` | Hotspot | captive portal, PPPoE server, pengguna PPP |
| `/routing` | Routing | tabel routing, route statis, policy routing, aplikasi, OSPF, BGP |
| `/monitoring` | Monitoring | trafik, flow, neighbour (ARP), log, diagnostik |
| `/system` | Sistem | nama router, pengaturan, firmware, layanan jarak jauh, SNMP, riwayat |

Tidak ada menu Dashboard: informasi Dashboard ada di perintah `show` setiap menu, dan informasi sistem di `/system resources`. Router vNR tidak memiliki menu `/wifi`.

### Berpindah menu

| Ketik | Artinya |
|---|---|
| `/internet uplinks` | pindah ke menu tersebut (jalur lengkap, dimulai dari `/`) |
| `uplinks` | pindah ke submenu dari menu tempat Anda berada |
| `..` | naik satu tingkat |
| `/` | kembali ke menu teratas |
| `/internet uplinks show` | jalankan perintah di menu itu tanpa pindah ke sana |

Contoh:

```
[niznet@nr642-1a2b] > /internet uplinks
[niznet@nr642-1a2b] /internet uplinks> ..
[niznet@nr642-1a2b] /internet> /
[niznet@nr642-1a2b] >
```

### Bantuan: `?` dan Tab

- **`?`** - tampilkan apa yang bisa diketik di posisi Anda: submenu, perintah yang tersedia di menu itu, pengaturan yang sedang terisi, perintah global, dan **mode commit yang aktif**. `?` langsung dijawab begitu diketik, tanpa Enter.
- **Tab** - melengkapi nama menu, perintah, nama item, atau nama pengaturan. Ketik beberapa huruf, lalu tekan Tab.
- **Panah atas/bawah** - memanggil kembali perintah sebelumnya.
- **Ctrl-C** - membatalkan baris yang sedang diketik (atau menghentikan `ping` yang sedang berjalan).

## 4. Perintah dasar

Hampir semua menu memakai perintah yang sama. Sebuah menu hanya menawarkan perintah yang memang berguna di sana - ketik `?` untuk melihat daftarnya.

| Perintah | Fungsi | Contoh |
|---|---|---|
| `show` (atau `print`) | tampilkan isi menu | `/internet uplinks show` |
| `show detail` | tampilkan dengan baris yang lebih lega | `/firewall rules show detail` |
| `show where ...` | tampilkan item yang cocok saja | `/firewall rules show where action=drop` |
| `add` | tambah item baru ke daftar | `/routing static add name=backup destination=10.60.0.0/16 gateway=192.168.45.3` |
| `set` | ubah pengaturan | `/internet uplinks set wan metric=5` |
| `unset` | kembalikan pengaturan ke nilai bawaan | `/local-network dns unset upstream` |
| `remove` | hapus item | `/firewall port-forwarding remove cam` |
| `enable` / `disable` | aktifkan / nonaktifkan item | `/firewall rules disable no-telnet` |
| `get` | tampilkan satu nilai | `/internet uplinks get wan metric` |
| `export` | tampilkan konfigurasi sebagai perintah (lihat di bawah) | `export` |

Nama item di contoh (misalnya `wan`, `no-telnet`, `cam`) hanyalah contoh. Lihat nama yang ada di router Anda dengan `show`.

### Menunjuk sebuah item

Item dalam daftar bisa ditunjuk dengan tiga cara:

1. **Namanya:** `/firewall rules disable no-telnet`
2. **Nomornya** dari `show` terakhir di menu itu. Nomor dimulai dari 0:

   ```
   [niznet@nr642-1a2b] > /firewall rules show
     0   name=no-telnet direction=input proto=tcp dport=23 action=drop ...
   [niznet@nr642-1a2b] > /firewall rules disable 0
   ```

   Item yang dinonaktifkan ditandai `X` di depannya.
3. **Pencarian:** `[find where kunci=nilai]`, misalnya:

   ```
   /firewall rules set [find where dport=23] action=reject
   ```

### Menulis nilai

- Bentuknya `kunci=nilai`, misalnya `metric=5`.
- Nilai yang berisi spasi diberi tanda kutip: `location="Floor 3"`.
- Beberapa nilai dipisah koma, tanpa spasi: `upstream=8.8.8.8,1.1.1.1`.
- Ya/tidak ditulis `yes` dan `no`.
- Pengaturan bertingkat memakai titik: `ntp.server=pool.ntp.org`, `security.passphrase="..."`.

### `export`: konfigurasi sebagai teks

`export` menampilkan konfigurasi dalam bentuk perintah yang dapat ditempel kembali. Di menu teratas (`/`), `export` menampilkan **seluruh** konfigurasi; di dalam sebuah menu, hanya bagian menu itu:

```
[niznet@nr642-1a2b] > /firewall
[niznet@nr642-1a2b] /firewall> export
/firewall status
set flow-offload=software conntrack-max=16384 mss-clamp=yes reverse-path-filter=yes
/firewall zones
add name=lan interface=br-lan input=reject ...
add name=wan interface=eth1 input=reject ...
...
```

Anda juga bisa menulis jalur menu di depan `export` dari menu mana pun. Misalnya `/firewall export` yang diketik di menu teratas menampilkan bagian firewall saja, sama seperti `export` di dalam `/firewall`.

Kata sandi dan kunci rahasia tidak ditampilkan di `export`. CLI 0.9.0 belum bisa menyimpan `export` ke file (`export file=` ditolak); untuk menyimpan konfigurasi ke file, lihat bagian 9.

## 5. Menyimpan perubahan: commit, review, dan rollback

Setiap perubahan konfigurasi disimpan sebagai **revisi** bernomor. Anda bisa melihat siapa mengubah apa dan kapan, dan kembali ke revisi sebelumnya kapan saja.

CLI punya dua **mode commit**. Mode yang aktif selalu disebutkan saat Anda masuk dan setiap kali Anda mengetik `?`.

### Mode immediate (bawaan): setiap perubahan langsung berlaku

Di mode ini, setiap perintah yang mengubah sesuatu langsung di-commit, melalui pemeriksaan yang sama seperti commit biasa. Router menampilkan apa yang berubah (`-` nilai lama, `+` nilai baru) dan nomor revisinya:

```
[niznet@nr642-1a2b] > /internet uplinks set wan metric=5
- /internet uplinks interface=wan metric=10
+ /internet uplinks interface=wan metric=5
committed as revision 14
```

Jika perubahan ditolak (misalnya nilainya tidak valid), router menjelaskan alasannya dan perubahan itu **tetap tertahan**:

```
not committed: ...
the change is staged; fix it and `commit`, or `discard`
```

Perbaiki lalu ketik `commit`, atau batalkan dengan `discard`.

### Mode review: kumpulkan dulu, periksa, lalu commit

Di mode review, perubahan **ditampung** dulu dan baru berlaku setelah Anda mengetik `commit`. Cocok untuk perubahan besar yang terdiri dari beberapa langkah. Aktifkan dengan:

```
/system configuration set commit-mode=review
```

Mode commit adalah pengaturan **untuk seluruh router**, bukan hanya untuk sesi Anda. Untuk kembali ke mode immediate:

```
/system configuration set commit-mode=immediate
commit
```

(Di mode review, perintah pertama ikut ditampung, jadi perlu `commit`.)

Perintah di mode review:

| Perintah | Fungsi |
|---|---|
| `compare` | tampilkan perubahan yang sedang ditampung dibandingkan dengan yang berjalan |
| `commit check` | periksa perubahan seperti saat commit, tanpa menerapkan apa pun |
| `commit` | terapkan semua perubahan yang ditampung |
| `commit comment="..."` | terapkan, dengan catatan yang ikut tersimpan di riwayat |
| `commit confirm=N` | terapkan, tetapi **otomatis dibatalkan dalam N menit** kecuali Anda mengetik `confirm` |
| `confirm` | pertahankan perubahan dari `commit confirm=N` (di sesi yang sama) |
| `discard` | buang semua perubahan yang ditampung |
| `update` | pindahkan perubahan Anda ke atas konfigurasi terbaru, jika orang lain (misalnya lewat WebUI) sudah meng-commit sesuatu sejak Anda mulai |

Setiap sesi CLI punya tampungannya sendiri, jadi perubahan Anda tidak tercampur dengan perubahan orang lain yang sedang bekerja di WebUI atau sesi lain.

Contoh:

```
[niznet@nr642-1a2b] > /local-network dns set upstream=8.8.8.8,1.1.1.1
...
staged; `commit` applies it, `compare` shows it
[niznet@nr642-1a2b] > compare
...
[niznet@nr642-1a2b] > commit comment="ganti DNS upstream"
committed as revision 15
```

### `commit confirm`: jaring pengaman saat mengubah akses jarak jauh

Saat mengubah sesuatu yang bisa memutus koneksi Anda sendiri ke router - port SSH, alamat yang boleh mengakses router, firewall, atau alamat LAN - gunakan `commit confirm=N`:

1. Router menerapkan perubahan dan mulai menghitung mundur N menit.
2. **Biarkan sesi ini tetap terbuka.** Dari jendela terminal baru, coba masuk dengan pengaturan yang baru.
3. Jika berhasil, kembali ke sesi pertama dan ketik `confirm` (atau tekan **Simpan perubahan ini** pada pemberitahuan di WebUI).
4. Jika Anda tidak bisa masuk lagi, **tidak perlu melakukan apa pun**: setelah N menit router kembali sendiri ke konfigurasi sebelumnya.

```
[niznet@nr642-1a2b] > commit confirm=5
committed as revision 16; it rolls back in 5 minutes unless you `confirm`
```

Di sesi pertama:

```
[niznet@nr642-1a2b] > confirm
confirmed: the change stays
```

`confirm` hanya diterima dari sesi yang menjalankan `commit confirm`; dari sesi lain, gunakan tombol **Simpan perubahan ini** di WebUI. Hanya ada satu hitung mundur pada satu waktu untuk setiap router.

CLI 0.9.0 tidak menolak perubahan port SSH yang dibuat tanpa `commit confirm`. Di mode immediate, perubahan itu langsung berlaku tanpa hitung mundur. Karena itu, untuk perubahan seperti ini selalu pindah ke mode review dan pakai `commit confirm=N` (contoh 6 di bagian 8).

Di dalam menu `/system firmware`, `confirm` dan `rollback` adalah perintah firmware (bagian 7). Ketik `confirm` dan `rollback N` untuk konfigurasi di luar menu itu.

### Riwayat dan rollback (di kedua mode)

| Perintah | Fungsi |
|---|---|
| `show history` | daftar semua commit: nomor revisi, waktu (UTC), sumbernya (`shell` = CLI, `api` dengan catatan "via web" = WebUI, `cloud`, `system`, `factory` = reset pabrik), akunnya, dan catatannya |
| `compare rollback=N` | bandingkan konfigurasi yang berjalan dengan revisi N, tanpa mengubah apa pun |
| `rollback N` | kembali ke revisi N |

Apa yang dilakukan `rollback N`:

- **Mode immediate:** router langsung kembali ke isi revisi N. Rollback ini dicatat sebagai **revisi baru**, jadi riwayat tidak pernah hilang dan rollback pun bisa di-rollback.

  ```
  rolled back to revision 12, as a new revision
  ```

- **Mode review:** isi revisi N (termasuk kata sandi dan kunci yang tersimpan di revisi itu) dimuat ke tampungan Anda **dan menggantikan semua perubahan yang sedang ditampung**. Belum ada yang berubah sampai Anda `commit`. Periksa dulu dengan `compare`, atau batalkan dengan `discard`.

  ```
  revision 12, its secrets included, is your candidate now (it replaced anything staged); `compare` shows it, `commit` applies it, `discard` drops it
  ```

Router menyimpan **30 revisi terakhir**; revisi yang lebih lama dihapus otomatis.

## 6. Menyaring keluaran (pipe)

Setelah `show`, `show history`, atau `export`, Anda bisa menambahkan tanda `|` dan sebuah penyaring:

| Pipe | Fungsi | Contoh |
|---|---|---|
| `\| match TEKS` | tampilkan baris yang mengandung TEKS saja | `/monitoring logs show \| match dhcp` |
| `\| except TEKS` | sembunyikan baris yang mengandung TEKS | `/wifi networks show \| except guest` |
| `\| count` | hitung jumlah baris | `/firewall rules show \| count` |
| `\| no-more` | tampilkan seluruh keluaran sekaligus. CLI 0.9.0 belum memecah keluaran per layar, jadi saat ini hasilnya sama | `export \| no-more` |

Pipe bisa dirangkai, dan dijalankan berurutan:

```
/firewall rules show where action=drop | match telnet | count
```

`| count` menjawab dalam bentuk `Count: 3 lines`. Pencarian `match` dan `except` membedakan huruf besar dan kecil.

## 7. Perintah operasional

### Diagnostik

```
/monitoring diagnostics ping 8.8.8.8 count=4
/monitoring diagnostics traceroute 8.8.8.8
/monitoring diagnostics dns-lookup niznet.com
```

| Perintah | Pilihan |
|---|---|
| `ping <alamat>` | `count=N`, `size=BYTE`, `vrf=NAMA` atau `src-address=ALAMAT`. Tanpa `count=`, ping berjalan terus sampai Anda menekan **Ctrl-C** (Ctrl-C hanya menghentikan ping, Anda tetap di CLI). |
| `traceroute <alamat>` | `max-hops=N` (bawaan 20), `vrf=NAMA` atau `src-address=ALAMAT` |
| `dns-lookup <nama>` | `server=ALAMAT` untuk bertanya ke server DNS tertentu |

### Status router

```
/system resources show
/system identity show
/system identity set hostname=kantor-pusat
/routing table show
/wifi clients show
/vpn ipsec status show
/vpn ipsec status show name=branch
```

- `/system resources show` - CPU, memori, dan waktu aktif.
- `/system identity` - nama router (yang tampil di prompt). Jika belum pernah diatur, router memakai nama bawaannya sendiri.
- `/vpn ipsec status show` - status langsung setiap site IPsec; dengan `name=<site>`, detail satu site.

### Firmware

```
/system firmware status
/system firmware confirm
/system firmware rollback
```

- `status` (sama dengan `show`) - versi firmware yang berjalan dan, jika firmware baru sedang dalam masa uji (trial), statusnya dan sisa waktunya.
- `confirm` - pertahankan firmware yang sedang dalam masa uji. Konfirmasi dicatat bersama alamat komputer SSH Anda.
- `rollback` - bertanya dulu, lalu kembali ke firmware sebelumnya atau membatalkan upgrade yang sudah dijadwalkan. Router akan restart.

Instalasi firmware baru dilakukan lewat WebUI (Sistem → Pengaturan → Firmware).

### Reboot

```
/system reboot
```

Router bertanya `Reboot, yes? [y/N]` dan hanya me-reboot jika Anda menjawab `y`. Reboot ditolak selama firmware baru masih dalam masa uji - konfirmasi atau rollback firmware-nya dulu.

### "Belum tersedia di shell ini"

Beberapa perintah lanjutan belum ada di CLI versi 0.9.0, tetapi sudah tersedia di WebUI. Jika Anda mengetiknya, router menjawab:

```
/system backup save: not in this shell yet - the WebUI has it
```

Artinya: *perintah ini belum tersedia di CLI - fitur ini ada di WebUI.* Router tidak pernah berpura-pura berhasil; tidak ada yang berubah. Daftarnya ada di bagian 9.

## 8. Contoh tugas dari awal sampai akhir

Semua contoh di bawah memakai mode immediate (bawaan). Nama, alamat, dan kata sandi hanya contoh - ganti dengan milik Anda.

### Contoh 1: Mengganti kata sandi Wi-Fi

Lihat dulu daftar jaringan Wi-Fi beserta nomornya:

```
[niznet@nr642-1a2b] > /wifi networks show
```

Lalu ganti kata sandi jaringan yang Anda inginkan, dengan namanya atau nomornya:

```
[niznet@nr642-1a2b] > /wifi networks set 0 security.passphrase="KataSandiBaru2026"
```

**Catatan:** Jika Anda terhubung ke router lewat Wi-Fi tersebut, koneksi Anda akan terputus. Sambungkan kembali dengan kata sandi baru.

### Contoh 2: Memberi alamat IP tetap untuk printer (reservasi DHCP)

```
[niznet@nr642-1a2b] > /local-network dhcp leases add name=printer mac=aa:bb:cc:00:11:22 ip=192.168.45.10
[niznet@nr642-1a2b] > /local-network dhcp leases show
```

Perangkat dengan alamat MAC tersebut selalu mendapat 192.168.45.10. `show` di menu ini juga menampilkan lease yang sedang aktif.

### Contoh 3: Menambah route statis

Agar jaringan 10.60.0.0/16 dicapai lewat router lain di 192.168.45.3:

```
[niznet@nr642-1a2b] > /routing static add name=backup destination=10.60.0.0/16 gateway=192.168.45.3
[niznet@nr642-1a2b] > /routing table show
```

Menonaktifkan sementara tanpa menghapus: `/routing static disable backup`.

### Contoh 4: Memeriksa koneksi internet

```
[niznet@nr642-1a2b] > /internet uplinks show
[niznet@nr642-1a2b] > /monitoring diagnostics ping 8.8.8.8 count=4
[niznet@nr642-1a2b] > /monitoring diagnostics dns-lookup niznet.com
```

`/internet uplinks show` menampilkan uplink yang dikonfigurasi (prioritas, probe, kuota). Jika ping ke 8.8.8.8 berhasil tetapi `dns-lookup` gagal, masalahnya ada di DNS - periksa `/local-network dns show`.

### Contoh 5: Membatalkan kesalahan dengan rollback

Anda baru saja mengubah sesuatu dan jaringan bermasalah. Lihat riwayat:

```
[niznet@nr642-1a2b] > show history
  REV  WHEN (UTC)          BY
   18  2026-11-07 03:12:40  shell, niznet
   17  2026-11-07 02:58:01  api, niznet  "via web"
   ...
```

Lihat apa yang berbeda dengan revisi sebelum kesalahan, lalu kembali ke sana:

```
[niznet@nr642-1a2b] > compare rollback=17
[niznet@nr642-1a2b] > rollback 17
rolled back to revision 17, as a new revision
```

### Contoh 6: Memindahkan port SSH dengan aman

Mengubah port SSH bisa memutus koneksi Anda sendiri, jadi gunakan mode review dan `commit confirm`:

```
[niznet@nr642-1a2b] > /system configuration set commit-mode=review
[niznet@nr642-1a2b] > /system remote-services set ssh port=2222
[niznet@nr642-1a2b] > compare
[niznet@nr642-1a2b] > commit confirm=5
committed as revision 19; it rolls back in 5 minutes unless you `confirm`
```

**Jangan tutup jendela ini.** Buka jendela terminal **baru** di komputer Anda dan coba masuk lewat port baru:

```
ssh -p 2222 niznet@192.168.45.1
```

Jika berhasil masuk, kembali ke jendela **pertama** dan ketik `confirm`:

```
[niznet@nr642-1a2b] > confirm
confirmed: the change stays
```

`confirm` diketik di sesi yang menjalankan `commit confirm`. Cara lain: masuk ke WebUI dan tekan **Simpan perubahan ini** pada pemberitahuan yang muncul. Jika Anda tidak bisa masuk lewat port 2222, tunggu 5 menit: router kembali ke port 22 dengan sendirinya. Setelah selesai, kembalikan ke mode immediate jika Anda mau (lihat bagian 5).

## 9. Yang masih lewat WebUI (versi 0.9.0)

CLI 0.9.0 sudah mencakup hampir semua **pengaturan**. Beberapa **tindakan** masih hanya ada di WebUI:

| Tindakan | Di WebUI |
|---|---|
| Upload dan instal firmware baru, cek pembaruan | Sistem → Pengaturan → Firmware |
| Backup dan restore konfigurasi ke file; reset ke pengaturan pabrik (login Anda dan kunci SSH tetap, kecuali Anda memilih kembali ke login bawaan pabrik) | Sistem → Pengaturan → Backup & Restore |
| Mengganti kata sandi Anda (setelah penggantian pertama), mengelola pengguna, kunci SSH | Sistem → Pengguna; Sistem → Pengaturan |
| Mengubah peran port menjadi LAN atau WAN | Internet → Ports |
| Memindai saluran Wi-Fi, memutus klien Wi-Fi | Wi-Fi |
| Voucher captive portal; memperpanjang atau mengakhiri sesi tamu | Hotspot → Captive Portal |
| Menjalankan bandwidth test | Monitoring → Diagnostik |
| Bergabung ke hub SD-WAN | VPN → SD-WAN Site |
| Mengelola cloud | Sistem → Cloud |
| Mengosongkan cache DNS; reset sesi BGP | Jaringan Lokal → DNS; Routing → BGP |
| Mengubah urutan aturan firewall dengan `move` | Firewall → Rules (atau di CLI: ubah nilai `sequence=` aturannya, misalnya `/firewall rules set no-telnet sequence=5`) |
| Menyimpan `export` ke file, atau `import` dari file | Sistem → Pengaturan → Backup & Restore |

Untuk `move`, router menjawab dengan petunjuk: untuk sementara gunakan `sequence=` untuk aturan firewall, `priority=` untuk policy routing, dan `order=` untuk server RADIUS.

## 10. Tips dan FAQ

**Apakah CLI dan WebUI bisa dipakai bersamaan?**
Bisa. Keduanya memakai satu konfigurasi yang sama. Perubahan yang di-commit dari CLI langsung terlihat di WebUI, dan sebaliknya. `show history` mencatat dari mana setiap perubahan berasal.

**Bagaimana cara keluar dari CLI?**
Ketik `quit` (atau `exit`). Di baris kosong, Ctrl-D juga mengakhiri sesi.

**Bisakah saya menjalankan satu perintah langsung dari komputer, tanpa masuk?**
Bisa - berguna untuk script dan pemantauan:

```
ssh niznet@192.168.45.1 '/system resources show'
```

Perintah yang ditolak menghasilkan kode keluar bukan nol, sehingga script Anda tahu bahwa perintah gagal. Pertanyaan konfirmasi (misalnya reboot) dianggap "tidak" jika tidak ada jawaban.

**Bagaimana cara mengembalikan router ke pengaturan pabrik?**
Selama Anda masih bisa masuk ke WebUI, gunakan menu Sistem → Pengaturan → Backup & Restore → **Reset pabrik…** (berlaku untuk NR642, NAP612, dan vNR). Login Anda tetap, kecuali Anda mencentang **Kembalikan juga ke login bawaan pabrik**; jika dicentang, router kembali ke login bawaan (`niznet` / `niznet`) dan meminta Anda menggantinya saat masuk.

Konfigurasi lama Anda tidak hilang dari riwayat: setelah masuk, Anda bisa melihatnya dengan `show history` dan mengembalikannya dengan `rollback N`.

**Catatan:** Setelah reset pabrik, vNR kembali mengambil alamat dari DHCP (atau 169.254.45.1 jika tidak ada DHCP); alamat tetap yang diatur saat instalasi di VPS tidak dipakai lagi. Pastikan Anda bisa membuka konsol hypervisor sebelum me-reset vNR.

**Saya lupa kata sandi dan tidak bisa masuk sama sekali. Apa yang harus dilakukan?**
- **vNR:** pasang ulang image vNR, lalu pulihkan pengaturan dari file backup. Tanpa backup, pengaturan hilang. vNR sengaja tidak punya cara reset atau jalan pintas pemulihan lain, agar celah keamanan di hypervisor tidak menjadi jalan masuk ke vNR. Karena itu, simpan backup setelah setup (Sistem → Pengaturan → Backup & Restore).
- **NR642 dan NAP612:** hubungi dukungan Niznet di info@niznet.com.

**Bagaimana jika saya salah mengubah sesuatu?**
Gunakan `rollback` (bagian 5). Untuk perubahan berisiko, biasakan memakai `commit confirm=N`.

**Kenapa perintah saya ditolak dengan "is not a command here" atau "has no ..."?**
Perintah itu tidak tersedia di menu tempat Anda berada - misalnya `disable` di menu yang item-nya tidak punya saklar aktif/nonaktif. Ketik `?` untuk melihat perintah yang tersedia di menu itu.

**Saya terbiasa dengan CLI router lain. Apakah mirip?**
Kemungkinan besar Anda akan cepat terbiasa: menu bertingkat, `print`/`show`, `add`/`set`/`remove`, penomoran item, `[find where ...]`, serta commit, compare, dan rollback bekerja seperti yang umum dipakai di CLI router.

---

# Lampiran: referensi perintah (bahasa Inggris)

Niznet OS 0.9.0 on NR642, NAP612 and vNR. NR451 (Niznet Lite) has no CLI in this release; its WebUI does everything.

## Logging in

An operator account (the WebUI's accounts) logs in over SSH or the console and lands in the CLI. The prompt says who and where:

```
[admin@r1] > /internet uplinks
[admin@r1] /internet uplinks>
```

- `?` at any point lists what can be typed there: the menus under this one, the commands it takes, the settings in use, and the commit mode.
- Tab completes a menu, a command, an item's name or a setting's name.
- A path starts at `/` or from the menu you stand in; `..` goes up; a path alone moves there, a path and a command runs it there.
- An item is named by the number `show` printed, by its name, or by `[find where key=value]`.
- Values are `key=value`; quote a value with spaces (`comment="floor 2"`); a list is comma-separated (`upstream=1.1.1.1,9.9.9.9`); booleans are `yes` and `no`; a deeper setting is dotted (`ntp.server=pool.ntp.org`).
- `ssh admin@unit '/system resources show'` runs one line and exits non-zero when it is refused.

## Commit modes

- **immediate** (the default): each command that changes something is committed at once, through the same checks as `commit`. A change that is refused stays staged and is said so: fix it and `commit`, or `discard`.
- **review**: changes wait in your own candidate until `commit`. `compare` shows them.

Set it with `/system configuration set commit-mode=review`. `?` always says which is active.

## Commands valid in every menu

| command | what it does |
|---|---|
| `commit` [`comment="..."`] [`confirm=N`] | applies your candidate; with `confirm=N` it rolls back in N minutes unless you `confirm` |
| `commit check` | checks the candidate as a commit would, applying nothing |
| `confirm` | keeps a change made with `commit confirm=N` |
| `compare` | your candidate against what runs |
| `compare rollback=N` | what runs against revision N |
| `rollback N` | back to revision N: at once in immediate mode (as a new revision), into your candidate in review mode, its secrets included |
| `discard` | drops your candidate |
| `update` | moves your candidate onto what runs now, keeping your edits |
| `show history` | every commit: its number, when, by whom and by what, and its comment |
| `export` | the configuration of the menu you stand in (all of it at `/`), as commands that can be pasted back |
| `quit` | logs out |

## Pipes

After `show` or `export`: `| match TEXT`, `| except TEXT`, `| count`, `| no-more`.

## The menus

### /internet

Uplinks, ports, bandwidth.

#### /internet uplinks

The ways out, their probes and quotas. Available on: NR642, NAP612, vNR.

A list: `add interface=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `comment` | text |
| `enabled` | `yes` or `no` |
| `gateway` | text |
| `metric` | a number |
| `mode` | for example `balance` |
| `probe` | for example `dns`, `gateway`, `icmp`, `tcp` |
| `probe-endpoint` | text |
| `probe-fail` | a number |
| `probe-interval` | a number |
| `probe-ok` | a number |
| `probe-port` | a number |
| `probe-target` | text |
| `probe-verdict` | for example `all`, `any`, `majority` |
| `quota-action` | for example `warn` |
| `quota-cycle` | for example `daily` |
| `quota-mb` | a number |
| `quota-start-day` | a number |
| `sibling` | text |
| `sla-jitter` | a number |
| `sla-loss` | a number |
| `sla-recover` | a number |
| `sla-rtt` | a number |
| `table` | a number |
| `weight` | a number |

#### /internet ports

A port LAN or WAN, as one move. Available on: NR642, NAP612, vNR.

No settings of its own. Commands: . Not in the CLI in this release (the WebUI has them): `set`.

#### /internet bandwidth limits

Per address, subnet or zone. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `enabled` | `yes` or `no` |
| `kind` | text |
| `rx-kbps` | a number |
| `tx-kbps` | a number |
| `value` | text |

#### /internet bandwidth shapers

An interface's egress. Available on: NR642, NAP612, vNR.

A list: `add interface=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `egress-kbps` | a number |
| `enabled` | `yes` or `no` |

**Examples.** A configuration under /internet, as `export` prints it:

```
/internet uplinks
add interface=wan enabled=yes metric=10
/internet bandwidth limits
add name=guest enabled=yes kind=subnet value=192.168.20.0/24 tx-kbps=5000 rx-kbps=20000
```

```
[admin@r1] > /internet uplinks set wan metric=5
```

```
[admin@r1] > /internet bandwidth limits add name=office kind=subnet value=192.168.88.0/24 rx-kbps=50000 tx-kbps=10000
```

### /local-network

Interfaces, VLANs, DHCP, DNS.

#### /local-network interfaces

Every interface as it runs. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /local-network interfaces ethernet

The router's ports. Available on: NR642, NAP612, vNR.

The unit's own items (`name`): `set`, never added or removed. Commands: `show`, `set`, `unset`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `autoneg` | `yes` or `no` |
| `description` | text |
| `duplex` | for example `full`, `half` |
| `eee` | `yes` or `no` |
| `enabled` | `yes` or `no` |
| `flow-control` | `yes` or `no` |
| `mac-limit` | a number |
| `mac-limit.<name>.action` | for example `cpu` |
| `mtu` | a number |
| `speed` | a number |
| `storm-control.broadcast` | a number |
| `storm-control.multicast` | a number |
| `storm-control.unknown-unicast` | a number |

#### /local-network interfaces bridges

Bridges and their members. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `ageing-time` | a number |
| `client-isolation` | `yes` or `no` |
| `loop-protection.action` | for example `block`, `log`, `shutdown` |
| `loop-protection.enabled` | `yes` or `no` |
| `loop-protection.interval` | a number |
| `loop-protection.port.<name>.action` | for example `block`, `log`, `shutdown` |
| `loop-protection.port.<name>.enabled` | `yes` or `no` |
| `loop-protection.port.<name>.interval` | a number |
| `loop-protection.port.<name>.recovery` | a number |
| `loop-protection.recovery` | a number |
| `mac` | a MAC address |
| `members` | a list: `a,b,c` |
| `multicast-group.<name>.vlan.<name>.ports` | a list: `a,b,c` |
| `multicast-last-member-interval` | a number |
| `multicast-querier` | `yes` or `no` |
| `multicast-query-interval` | a number |
| `multicast-snooping` | `yes` or `no` |
| `port.<name>.dot1x` | for example `auto`, `force-authorized`, `force-unauthorized` |
| `port.<name>.isolated` | `yes` or `no` |
| `port.<name>.multicast-fast-leave` | `yes` or `no` |
| `port.<name>.multicast-router` | for example `auto`, `disabled`, `permanent` |
| `port.<name>.pvid` | a number |
| `port.<name>.vlan-mode` | for example `access`, `hybrid`, `trunk` |
| `port.<name>.voice-dscp` | a number |
| `port.<name>.voice-priority` | a number |
| `port.<name>.voice-vlan` | a number |
| `spanning-tree.forward-delay` | a number |
| `spanning-tree.hello-time` | a number |
| `spanning-tree.max-age` | a number |
| `spanning-tree.mode` | for example `mstp`, `rstp`, `stp` |
| `spanning-tree.mst-instance.<name>.priority` | a number |
| `spanning-tree.mst-instance.<name>.vlans` | a list: `a,b,c` |
| `spanning-tree.mst-region` | text |
| `spanning-tree.mst-revision` | a number |
| `spanning-tree.port.<name>.admin-edge` | `yes` or `no` |
| `spanning-tree.port.<name>.auto-edge` | `yes` or `no` |
| `spanning-tree.port.<name>.bpdu-filter` | `yes` or `no` |
| `spanning-tree.port.<name>.bpdu-guard` | `yes` or `no` |
| `spanning-tree.port.<name>.enabled` | `yes` or `no` |
| `spanning-tree.port.<name>.path-cost` | a number |
| `spanning-tree.port.<name>.priority` | a number |
| `spanning-tree.port.<name>.restricted-tcn` | `yes` or `no` |
| `spanning-tree.port.<name>.root-guard` | `yes` or `no` |
| `spanning-tree.priority` | a number |
| `static-mac.<name>.vlan.<name>.port` | text |
| `stp` | `yes` or `no` |
| `vlan-filtering` | `yes` or `no` |

#### /local-network interfaces loopbacks

Loopback addresses. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `description` | text |
| `enabled` | `yes` or `no` |

#### /local-network interfaces gre

GRE tunnels. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `checksum` | `yes` or `no` |
| `description` | text |
| `enabled` | `yes` or `no` |
| `ipsec` | text |
| `ipsec-mode` | for example `tunnel` |
| `keepalive` | several words, quoted |
| `key` | a number |
| `local` | text |
| `mode` | for example `ethernet` |
| `mss-clamp` | `yes` or `no` |
| `mtu` | a number |
| `remote` | text |
| `sequence` | `yes` or `no` |
| `ttl` | a number |

#### /local-network interfaces bonds

Link aggregation. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `arp-interval` | a number |
| `arp-ip-target` | text |
| `description` | text |
| `down-delay` | a number |
| `enabled` | `yes` or `no` |
| `lacp-rate` | for example `fast` |
| `link-monitoring` | for example `arp` |
| `member` | text |
| `mii-interval` | a number |
| `min-links` | a number |
| `mode` | for example `802.3ad`, `active-backup`, `balance-alb`, `balance-rr`, `balance-tlb`, `balance-xor`, `broadcast` |
| `mtu` | a number |
| `primary` | text |
| `transmit-hash-policy` | for example `encap2+3`, `encap3+4`, `layer2+3`, `layer3+4` |
| `up-delay` | a number |

#### /local-network interfaces vrrp

VRRP groups. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `accept-mode` | `yes` or `no` |
| `address` | text |
| `advertise-interval` | a number |
| `checksum` | for example `pseudo-header`, `rfc9568` |
| `description` | text |
| `enabled` | `yes` or `no` |
| `interface` | text |
| `preempt` | `yes` or `no` |
| `preempt-delay` | a number |
| `priority` | a number |
| `track-hold-down` | a number |
| `track-hold-up` | a number |
| `track.interface.<name>.decrement` | a number |
| `track.uplink.<name>.decrement` | a number |
| `vrid` | a number |

#### /local-network vlans

A bridge's VLANs. Available on: NR642, NAP612, vNR.

A list: `add bridge=... vlan-id=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `name` | text |
| `tagged` | a list: `a,b,c` |
| `untagged` | a list: `a,b,c` |

#### /local-network vlans interfaces

VLAN interfaces. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `id` | a number |
| `parent` | text |

#### /local-network dhcp

DHCP. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`.

| setting | value |
|---|---|
| `implicit-pools` | `yes` or `no` |

#### /local-network dhcp server

A pool per interface. Available on: NR642, NAP612, vNR.

A list: `add interface=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `dns` | text |
| `enabled` | `yes` or `no` |
| `end` | text |
| `gateway` | text |
| `lease` | text |
| `start` | text |

#### /local-network dhcp leases

Reservations; the leases as they run. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `ip` | text |
| `mac` | a MAC address |

#### /local-network dns

The resolver. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`. Not in the CLI in this release (the WebUI has them): `cache`.

| setting | value |
|---|---|
| `domain` | text |
| `serve` | `yes` or `no` |
| `upstream` | text |

#### /local-network dns hosts

Static names. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `<name>` | a flag: the word alone |

**Examples.** A configuration under /local-network, as `export` prints it:

```
/local-network interfaces ethernet
set lan1 enabled=yes mtu=1500
set lan2 enabled=yes mtu=1500
set wan enabled=yes mtu=1500 dhcp-client
/local-network interfaces bridges
add name=br-lan members="lan1,lan2" stp=no client-isolation=no vlan-filtering=no address=192.168.88.1/24
/local-network vlans interfaces
add name=vlan20 parent=br-lan id=20 address=192.168.20.1/24
/local-network dhcp server
add interface=br-lan enabled=yes start=192.168.88.100 end=192.168.88.200
/local-network dhcp leases
add name=printer mac=aa:bb:cc:00:11:22 ip=192.168.88.10
/local-network dns
set upstream=1.1.1.1,9.9.9.9
```

```
[admin@r1] > /local-network dns set upstream=8.8.8.8,1.1.1.1
```

```
[admin@r1] > /local-network dhcp leases add name=nas mac=aa:bb:cc:00:11:33 ip=192.168.88.11
```

### /wifi

Radios, networks, clients.

#### /wifi radios

The router's radios. Available on: NR642, NAP612.

The unit's own items (`name`): `set`, never added or removed. Commands: `show`, `set`, `unset`, `get`, `enable`, `disable`. Not in the CLI in this release (the WebUI has them): `scan`.

| setting | value |
|---|---|
| `band` | a number; for example `2.4` |
| `bss-color` | a number |
| `bss-load` | `yes` or `no` |
| `channel` | a number; for example `auto` |
| `client.bridge` | text |
| `client.bssid` | text |
| `client.enabled` | `yes` or `no` |
| `client.mode` | for example `wds` |
| `client.psk` | text |
| `client.ssid` | text |
| `country` | text |
| `csa` | `yes` or `no` |
| `dfs` | `yes` or `no` |
| `enabled` | `yes` or `no` |
| `high-density` | `yes` or `no` |
| `min-rssi` | a number |
| `tx-power` | a number |
| `width` | a number |
| `wifi6` | `yes` or `no` |
| `wifi7` | `yes` or `no` |

#### /wifi networks

Networks (SSID). Available on: NR642, NAP612.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `bridge` | text |
| `dynamic-vlan` | `yes` or `no` |
| `enabled` | `yes` or `no` |
| `hidden` | `yes` or `no` |
| `key.<name>.passphrase.<name>.vlan.<name>.max-devices.<name>.expires` | text |
| `mac` | a MAC address |
| `mac-filter` | for example `allow`, `deny` |
| `max-clients` | a number |
| `mlo` | `yes` or `no` |
| `mlo-link` | text |
| `radio` | text |
| `radius` | text |
| `rate-limit.total` | a number |
| `roaming` | for example `assisted`, `fast` |
| `schedule` | several words, quoted |
| `security.mode` | for example `open`, `wpa2`, `wpa2-enterprise`, `wpa2-wpa3`, `wpa3`, `wpa3-enterprise` |
| `security.passphrase` | text |
| `ssid` | text |
| `vlan` | a number |
| `wds` | `yes` or `no` |
| `wps` | `yes` or `no` |

#### /wifi clients

Who is connected. Available on: NR642, NAP612.

What runs, read-only. Commands: `show`. Not in the CLI in this release (the WebUI has them): `disconnect`.

#### /wifi neighbours

The 802.11k neighbour list. Available on: NR642, NAP612.

A list: `add bssid=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `channel` | a number |
| `ssid` | text |

#### /wifi backhaul

The wireless uplink. Available on: NR642, NAP612.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `enabled` | `yes` or `no` |
| `gateway` | text |
| `gateway-fail` | a number |
| `key` | text |
| `max-switches` | a number |
| `port` | text |
| `radio` | text |
| `return-after` | a number |
| `ssid` | text |

**Examples.** A configuration under /wifi, as `export` prints it:

```
/wifi radios
set radio0 band=2.4 channel=6 width=20 enabled=yes
/wifi networks
add name=home radio=radio0 ssid=Home hidden=no security.mode=wpa2 security.passphrase="" enabled=yes
```

```
[admin@r1] > /wifi radios set radio0 channel=11
```

### /firewall

Zones, rules, port forwarding, web filter.

#### /firewall status

The firewall's settings and its state. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`.

| setting | value |
|---|---|
| `conntrack-max` | a number |
| `flow-offload` | for example `software` |
| `mss-clamp` | `yes` or `no` |
| `pptp-passthrough` | `yes` or `no` |
| `reverse-path-filter` | `yes` or `no` |

#### /firewall zones

Zones and their policies. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `force-dns` | `yes` or `no` |
| `forward-to` | text |
| `input` | for example `accept`, `drop`, `reject` |
| `interface` | text |
| `intra-zone-forward` | `yes` or `no` |
| `masquerade` | `yes` or `no` |
| `max-forward-connections` | a number |
| `service` | for example `dhcp`, `dns`, `http`, `https`, `ospf`, `ping`, `snmp`, `ssh` |
| `stateless-transit` | `yes` or `no` |

#### /firewall rules

Filter rules, in order. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`. `move` is not in the CLI in this release: set `sequence=`.

| setting | value |
|---|---|
| `action` | for example `accept`, `drop`, `reject` |
| `comment` | text |
| `direction` | for example `forward`, `input` |
| `dport` | text |
| `dst` | text |
| `egress` | text |
| `enabled` | `yes` or `no` |
| `from` | text |
| `log` | `yes` or `no` |
| `proto` | for example `any`, `icmp`, `tcp`, `udp` |
| `sequence` | a number |
| `src` | text |
| `to` | text |

#### /firewall web-filter

Blocked domains. Available on: NR642, NAP612, vNR.

A list: `add domain=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

#### /firewall port-forwarding

Port forwarding. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `proto` | for example `tcp`, `udp` |
| `to-address` | text |
| `to-port` | a number |
| `wan-port` | a number |
| `zone` | text |

**Examples.** A configuration under /firewall, as `export` prints it:

```
/firewall status
set flow-offload=software conntrack-max=16384 mss-clamp=yes reverse-path-filter=yes
/firewall zones
add name=lan interface=br-lan input=drop masquerade=no
add name=wan interface=wan input=drop masquerade=yes
/firewall rules
add name=no-telnet enabled=yes sequence=0 direction=input proto=tcp action=drop log=no from=wan dport=23
/firewall web-filter
add domain=ads.example.com
/firewall port-forwarding
add name=cam proto=tcp zone="" wan-port=8080 to-address=192.168.88.20 to-port=80
```

```
[admin@r1] > /firewall rules disable no-telnet
```

```
[admin@r1] > /firewall port-forwarding remove cam
```

### /vpn

WireGuard, OpenVPN, IPsec, SSTP, PPTP, SD-WAN.

#### /vpn wireguard

WireGuard interfaces. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `address` | text |
| `enabled` | `yes` or `no` |
| `listen-port` | a number |
| `managed` | `yes` or `no` |
| `path-api` | text |
| `private-key` | text |
| `zone` | text |

#### /vpn wireguard peers

Each interface's peers. Available on: NR642, NAP612, vNR.

A list: `add interface=... name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `allowed-ips` | text |
| `endpoint` | text |
| `keepalive` | several words, quoted |
| `public-key` | text |

#### /vpn openvpn server

OpenVPN servers. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `cipher` | text |
| `dns` | text |
| `enabled` | `yes` or `no` |
| `keepalive` | several words, quoted |
| `port` | a number |
| `proto` | for example `tcp` |
| `push-route` | text |
| `server-subnet` | text |
| `zone` | text |

#### /vpn openvpn users

A server's users. Available on: NR642, NAP612, vNR.

A list: `add server=... name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `enabled` | `yes` or `no` |
| `static-ip` | text |

#### /vpn openvpn client

OpenVPN clients. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `add-default-route` | `yes` or `no` |
| `auth` | text |
| `cipher` | text |
| `connect-to` | text |
| `enabled` | `yes` or `no` |
| `port` | a number |
| `proto` | for example `tcp` |
| `server-fingerprint` | text |
| `user` | text |
| `verify-server` | for example `ca`, `fingerprint` |
| `zone` | text |

#### /vpn openvpn status

OpenVPN as it runs. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /vpn ipsec sites

Site-to-site. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `child-lifetime` | a number |
| `dh-group` | for example `curve25519`, `ecp256`, `ecp384`, `ecp521`, `modp1536`, `modp2048`, `modp3072`, `modp4096` |
| `dpd-delay` | a number |
| `dpd-timeout` | a number |
| `enabled` | `yes` or `no` |
| `encryption` | for example `3des`, `aes128`, `aes128gcm`, `aes256`, `aes256gcm`, `chacha20poly1305` |
| `force-encap` | `yes` or `no` |
| `ike-lifetime` | a number |
| `initiate` | `yes` or `no` |
| `integrity` | for example `sha1`, `sha256`, `sha384`, `sha512` |
| `legacy` | `yes` or `no` |
| `local-address` | text |
| `local-id` | text |
| `mode` | for example `policy`, `transport` |
| `pair.<name>` | text |
| `pfs` | `yes` or `no` |
| `pfs-group` | for example `curve25519`, `ecp256`, `ecp384`, `ecp521`, `modp1536`, `modp2048`, `modp3072`, `modp4096` |
| `remote-address` | text |
| `remote-id` | text |
| `route` | text |
| `tunnel-address` | text |
| `version` | for example `ikev1` |
| `zone` | text |

#### /vpn ipsec remote-access

IKEv2 remote access. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `certificate` | text |
| `child-lifetime` | a number |
| `dh-group` | for example `curve25519`, `ecp256`, `ecp384`, `ecp521`, `modp1536`, `modp2048`, `modp3072`, `modp4096` |
| `dns` | text |
| `dpd-delay` | a number |
| `enabled` | `yes` or `no` |
| `encryption` | for example `3des`, `aes128`, `aes128gcm`, `aes256`, `aes256gcm`, `chacha20poly1305` |
| `ike-lifetime` | a number |
| `integrity` | for example `sha1`, `sha256`, `sha384`, `sha512` |
| `legacy` | `yes` or `no` |
| `local-id` | text |
| `pool` | text |
| `profile` | text |
| `split-include` | text |
| `zone` | text |

#### /vpn ipsec l2tp-server

L2TP/IPsec server. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `dh-group` | for example `curve25519`, `ecp256`, `ecp384`, `ecp521`, `modp1536`, `modp2048`, `modp3072`, `modp4096` |
| `dns` | text |
| `enabled` | `yes` or `no` |
| `encryption` | for example `3des`, `aes128`, `aes128gcm`, `aes256`, `aes256gcm`, `chacha20poly1305` |
| `integrity` | for example `sha1`, `sha256`, `sha384`, `sha512` |
| `ipsec` | for example `none` |
| `legacy` | `yes` or `no` |
| `local-address` | text |
| `radius` | `yes` or `no` |
| `remote-address` | text |
| `unencrypted` | `yes` or `no` |
| `zone` | text |

#### /vpn ipsec l2tp-client

L2TP clients. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `add-default-route` | `yes` or `no` |
| `connect-to` | text |
| `dh-group` | for example `curve25519`, `ecp256`, `ecp384`, `ecp521`, `modp1536`, `modp2048`, `modp3072`, `modp4096` |
| `enabled` | `yes` or `no` |
| `encryption` | for example `3des`, `aes128`, `aes128gcm`, `aes256`, `aes256gcm`, `chacha20poly1305` |
| `integrity` | for example `sha1`, `sha256`, `sha384`, `sha512` |
| `ipsec` | for example `none` |
| `legacy` | `yes` or `no` |
| `profile` | text |
| `unencrypted` | `yes` or `no` |
| `user` | text |
| `zone` | text |

#### /vpn ipsec status

IPsec as it runs. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /vpn sstp server

The SSTP server. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `certificate` | text |
| `enabled` | `yes` or `no` |
| `legacy-tls` | `yes` or `no` |
| `port` | a number |
| `profile` | text |
| `radius` | `yes` or `no` |
| `rsa-certificate` | `yes` or `no` |
| `zone` | text |

#### /vpn sstp client

SSTP clients. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `add-default-route` | `yes` or `no` |
| `ca` | text |
| `connect-to` | text |
| `enabled` | `yes` or `no` |
| `pin` | text |
| `port` | a number |
| `profile` | text |
| `user` | text |
| `verify` | for example `ca`, `pin` |
| `zone` | text |

#### /vpn pptp server

The PPTP server (legacy). Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `acknowledge-insecure` | `yes` or `no` |
| `enabled` | `yes` or `no` |
| `max-sessions` | a number |
| `profile` | text |
| `radius` | `yes` or `no` |
| `zone` | text |

#### /vpn pptp client

PPTP clients (legacy). Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `acknowledge-insecure` | `yes` or `no` |
| `add-default-route` | `yes` or `no` |
| `connect-to` | text |
| `enabled` | `yes` or `no` |
| `profile` | text |
| `user` | text |
| `zone` | text |

#### /vpn sd-wan site

Join a hub; the control planes. Available on: NR642, NAP612, vNR.

No settings of its own. Commands: . Not in the CLI in this release (the WebUI has them): `join`, `show`.

#### /vpn sd-wan hub

Hubs other sites meet at. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `address` | text |
| `description` | text |
| `direct-paths` | `yes` or `no` |
| `enabled` | `yes` or `no` |
| `link-port` | a number |
| `listen-port` | a number |
| `managed` | `yes` or `no` |
| `rank` | a number |
| `relay-rate` | a number |

#### /vpn sd-wan hub sites

A hub's sites. Available on: NR642, NAP612, vNR.

A list: `add hub=... name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `address` | text |
| `description` | text |
| `direct-sites` | text |
| `enabled` | `yes` or `no` |
| `endpoint` | text |
| `kind` | for example `client`, `hub`, `site` |
| `networks` | text |
| `public-key` | text |
| `reach` | text |

**Examples.** A configuration under /vpn, as `export` prints it:

```
/vpn wireguard
add name=wg0 enabled=yes listen-port=51820 address=10.9.0.1/24
```

```
[admin@r1] > /vpn wireguard set wg0 listen-port=51821
```

### /hotspot

Captive portal, PPPoE server, PPP users.

#### /hotspot captive-portal

Sign-in portals. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `accent` | text |
| `allowed-site.<name>` | text |
| `auth` | for example `click`, `password`, `radius`, `voucher` |
| `blocklist.<name>` | text |
| `code-digits` | `yes` or `no` |
| `code-length` | a number |
| `default-quota-mb` | a number |
| `default-rx-kbps` | a number |
| `default-tx-kbps` | a number |
| `display-name` | text |
| `enabled` | `yes` or `no` |
| `footer` | text |
| `idle-minutes` | a number |
| `language` | for example `auto`, `id` |
| `message` | text |
| `redirect-url` | text |
| `session-minutes` | a number |
| `shelf-days` | a number |
| `terms` | text |
| `terms-agree` | `yes` or `no` |
| `text.<name>` | text |
| `theme` | text |
| `title` | text |
| `zone` | text |

#### /hotspot captive-portal packages

What a guest buys. Available on: NR642, NAP612, vNR.

A list: `add portal=... name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `code-prefix` | text |
| `comment` | text |
| `devices` | a number |
| `enabled` | `yes` or `no` |
| `id` | a number |
| `minutes` | a number |
| `quota-mb` | a number |
| `rx-kbps` | a number |
| `tx-kbps` | a number |
| `valid-days` | a number |

#### /hotspot captive-portal vouchers

Voucher codes. Available on: NR642, NAP612, vNR.

No settings of its own. Commands: . Not in the CLI in this release (the WebUI has them): `create`, `revoke`, `print`, `show`.

#### /hotspot captive-portal allowed

Devices let through. Available on: NR642, NAP612, vNR.

A list: `add portal=... mac=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `<name>` | a flag: the word alone |

#### /hotspot captive-portal signed-in

Who is signed in. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`. Not in the CLI in this release (the WebUI has them): `extend`, `end`, `block`.

#### /hotspot captive-portal report

The portal's activity. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /hotspot pppoe-server

PPPoE servers. Available on: NR642, NAP612, vNR.

A list: `add interface=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `ac-name` | text |
| `auth` | for example `pap` |
| `dns` | text |
| `enabled` | `yes` or `no` |
| `local-address` | text |
| `max-sessions` | a number |
| `mtu` | a number |
| `one-session-per-host` | `yes` or `no` |
| `radius` | `yes` or `no` |
| `remote-start` | text |
| `service-name` | text |
| `zone` | text |

#### /hotspot pppoe-server subscribers

A server's subscribers. Available on: NR642, NAP612, vNR.

A list: `add server=... name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `enabled` | `yes` or `no` |
| `rate-limit` | text |
| `static-ip` | text |

#### /hotspot pppoe-server active

PPPoE sessions. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /hotspot ppp-users

PPP accounts. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `enabled` | `yes` or `no` |
| `profile` | text |
| `routes` | text |
| `service` | for example `ikev2`, `l2tp`, `pppoe`, `pptp`, `sstp` |
| `static-address` | text |

#### /hotspot ppp-users profiles

PPP profiles. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `allow-several` | `yes` or `no` |
| `change-tcp-mss` | `yes` or `no` |
| `dns` | text |
| `idle-timeout` | a number |
| `local-address` | text |
| `only-one` | `yes` or `no` |
| `rate-limit` | text |
| `remote-address` | text |
| `session-timeout` | a number |
| `zone` | text |

#### /hotspot ppp-users active

PPP sessions. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

### /routing

Routes, policy, applications, OSPF, BGP, filters.

#### /routing table

The routing table. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /routing static

Static routes. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `comment` | text |
| `destination` | text |
| `distance` | a number |
| `enabled` | `yes` or `no` |
| `gateway` | text |
| `interface` | text |
| `metric` | a number |
| `next-hop-vrf` | text |
| `table` | text |
| `vrf` | text |

#### /routing static distance

Each protocol's distance. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`.

| setting | value |
|---|---|
| `ebgp` | a number |
| `ibgp` | a number |
| `ospf-external` | a number |
| `ospf-inter` | a number |
| `ospf-intra` | a number |

#### /routing vrfs

VRFs. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `description` | text |
| `interface` | text |
| `table` | a number |

#### /routing policy

Policy routing, by priority. Available on: NR642, NAP612, vNR.

A list: `add priority=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`. `move` is not in the CLI in this release: set `priority=`.

| setting | value |
|---|---|
| `action` | for example `blackhole`, `prohibit`, `unreachable` |
| `application` | text |
| `balance-by` | for example `connection` |
| `description` | text |
| `destination-port` | text |
| `dscp` | a number |
| `enabled` | `yes` or `no` |
| `fallback` | for example `unreachable` |
| `from` | text |
| `fwmark` | text |
| `in-interface` | text |
| `in-zone` | text |
| `limit-down` | a number |
| `limit-up` | a number |
| `max-jitter` | a number |
| `max-loss` | a number |
| `max-rtt` | a number |
| `protocol` | text |
| `schedule` | several words, quoted |
| `source-port` | text |
| `spillover.<name>` | a number |
| `strategy` | for example `balance`, `best-quality`, `spillover` |
| `table` | text |
| `to` | text |
| `traffic` | for example `all`, `router` |
| `tunnel` | text |
| `uplink` | text |
| `uplinks` | text |
| `weight.<name>` | a number |

#### /routing policy tables

Routing tables. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `description` | text |
| `id` | a number |

#### /routing applications

Application steering. Available on: NR642, NAP612, vNR.

A list: `add id=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `comment` | text |
| `coverage` | for example `dns`, `dns+published`, `partial` |
| `disabled` | `yes` or `no` |
| `domain` | text |
| `name` | text |
| `port` | text |
| `prefix` | text |

#### /routing applications usage

Usage counting. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `` | a flag: the word alone |
| `enabled` | `yes` or `no` |

#### /routing ospf instances

OSPF instances. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `accept-default` | `yes` or `no` |
| `address-family` | for example `ipv4-unicast`, `ipv6-unicast` |
| `default-information.always` | `yes` or `no` |
| `default-information.metric` | a number |
| `default-information.metric-type` | a number |
| `default-information.originate` | `yes` or `no` |
| `default-information.uplinks-fit` | `yes` or `no` |
| `default-metric` | a number |
| `enabled` | `yes` or `no` |
| `engine` | for example `native`, `supported` |
| `export-map` | text |
| `graceful-restart` | `yes` or `no` |
| `graceful-restart-helper` | `yes` or `no` |
| `graceful-restart-period` | a number |
| `import-map` | text |
| `import-prefix-list` | text |
| `install-routes` | `yes` or `no` |
| `lsa-min-arrival` | a number |
| `lsa-min-interval` | a number |
| `max-metric` | `yes` or `no` |
| `max-metric-on-startup` | a number |
| `maximum-paths` | a number |
| `redistribute` | for example `bgp`, `connected`, `ospf`, `static` |
| `redistribute.bgp.metric` | a number |
| `redistribute.bgp.metric-type` | a number |
| `redistribute.bgp.route-map` | text |
| `redistribute.bgp.tag` | a number |
| `redistribute.connected.metric` | a number |
| `redistribute.connected.metric-type` | a number |
| `redistribute.connected.route-map` | text |
| `redistribute.connected.tag` | a number |
| `redistribute.ospf.metric` | a number |
| `redistribute.ospf.metric-type` | a number |
| `redistribute.ospf.route-map` | text |
| `redistribute.ospf.tag` | a number |
| `redistribute.static.metric` | a number |
| `redistribute.static.metric-type` | a number |
| `redistribute.static.route-map` | text |
| `redistribute.static.tag` | a number |
| `reference-bandwidth` | a number |
| `router-id` | text |
| `spf-hold-down` | a number |
| `spf-initial-delay` | a number |
| `spf-long-wait` | a number |
| `spf-short-wait` | a number |
| `spf-time-to-learn` | a number |
| `summary-address` | text |
| `summary-address.<name>.not-advertise` | `yes` or `no` |
| `summary-address.<name>.tag` | a number |
| `supported-metric` | `yes` or `no` |
| `version` | for example `v3` |
| `vrf` | text |

#### /routing ospf networks

An instance's networks. Available on: NR642, NAP612, vNR.

A list: `add instance=... prefix=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `area` | text |

#### /routing ospf areas

An instance's areas. Available on: NR642, NAP612, vNR.

A list: `add instance=... area=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `default-cost` | a number |
| `no-summary` | `yes` or `no` |
| `nssa-default-originate` | `yes` or `no` |
| `nssa-translator` | for example `always`, `candidate`, `never` |
| `nssa-translator-stability` | a number |
| `range` | text |
| `range.<name>.cost` | a number |
| `range.<name>.not-advertise` | `yes` or `no` |
| `type` | for example `nssa`, `stub` |
| `virtual-link` | text |
| `virtual-link.<name>.dead` | a number |
| `virtual-link.<name>.hello` | a number |
| `virtual-link.<name>.retransmit` | a number |

#### /routing ospf interfaces

An area's interfaces. Available on: NR642, NAP612, vNR.

A list: `add instance=... area=... interface=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `auth-key` | text |
| `auth-key-id` | a number |
| `auth-mode` | for example `md5`, `sha1`, `sha256`, `sha384`, `sha512`, `simple` |
| `bfd` | `yes` or `no` |
| `cost` | a number |
| `dead` | a number |
| `hello` | a number |
| `instance-id` | a number |
| `key-chain` | text |
| `key-preparation` | for example `rfc2104`, `rfc5709` |
| `mtu-ignore` | `yes` or `no` |
| `neighbor` | text |
| `network` | for example `broadcast`, `point-to-multipoint`, `point-to-point` |
| `passive` | `yes` or `no` |
| `priority` | a number |
| `retransmit` | a number |
| `transmit-delay` | a number |

#### /routing ospf key-chains

Authentication keys. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `key.<name>.accept-from` | for example `2026-01-01T00:00:56Z` |
| `key.<name>.accept-until` | for example `2026-01-01T00:00:57Z` |
| `key.<name>.algorithm` | for example `md5`, `sha1`, `sha256`, `sha384`, `sha512` |
| `key.<name>.key-preparation` | for example `rfc2104`, `rfc5709` |
| `key.<name>.secret` | text |
| `key.<name>.send-from` | for example `2026-01-01T00:00:54Z` |
| `key.<name>.send-until` | for example `2026-01-01T00:00:55Z` |
| `send-key` | a number |

#### /routing ospf neighbours

OSPF neighbours. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /routing ospf interface-state

OSPF interfaces as they run. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /routing ospf database

The link-state database. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /routing ospf routes

OSPF's routes. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /routing bgp instances

BGP instances; the router-wide settings. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `accept-default` | `yes` or `no` |
| `aggregate` | text |
| `aggregate.<name>.as-set` | `yes` or `no` |
| `aggregate.<name>.matching-med-only` | `yes` or `no` |
| `aggregate.<name>.route-map` | text |
| `aggregate.<name>.summary-only` | `yes` or `no` |
| `always-compare-med` | `yes` or `no` |
| `asn` | a number |
| `bfd.enabled` | `yes` or `no` |
| `bfd.min-rx` | a number |
| `bfd.min-tx` | a number |
| `bfd.multiplier` | a number |
| `confederation` | a number |
| `confederation-member` | a number |
| `dampening.half-life` | a number |
| `dampening.max-suppress` | a number |
| `dampening.reuse` | a number |
| `dampening.suppress` | a number |
| `default-local-pref` | a number |
| `fast-external-fallover` | `yes` or `no` |
| `honour-graceful-shutdown` | `yes` or `no` |
| `maximum-paths.ebgp` | a number |
| `maximum-paths.ibgp` | a number |
| `med-missing-as-worst` | `yes` or `no` |
| `multipath-relax` | `yes` or `no` |
| `network` | text |
| `router-id` | text |
| `vrf` | text |

#### /routing bgp peers

BGP neighbours. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `add-path` | for example `both`, `receive`, `send` |
| `add-path-best` | a number |
| `add-path-limit` | a number |
| `allowas-in` | a number |
| `bfd` | `yes` or `no` |
| `connect-retry` | a number |
| `dampening` | `yes` or `no` |
| `default-originate` | `yes` or `no` |
| `default-originate-map` | text |
| `default-originate-uplinks-fit` | `yes` or `no` |
| `enabled` | `yes` or `no` |
| `enforce-first-as` | `yes` or `no` |
| `engine` | for example `native`, `supported` |
| `export-map` | text |
| `export-prefix-list` | text |
| `graceful-shutdown` | `yes` or `no` |
| `hold-time` | a number |
| `import-map` | text |
| `import-prefix-list` | text |
| `install-routes` | `yes` or `no` |
| `instance` | text |
| `keepalive` | several words, quoted |
| `local-as` | a number |
| `max-prefix` | a number |
| `max-prefix-action` | for example `restart`, `warn` |
| `multihop` | a number |
| `neighbor` | text |
| `next-hop-self` | `yes` or `no` |
| `passive` | `yes` or `no` |
| `password` | text |
| `redistribute` | for example `bgp`, `connected`, `ospf`, `static` |
| `remote-as` | a number |
| `remove-private-as` | `yes` or `no` |
| `role` | for example `customer`, `peer`, `provider`, `rs`, `rs-client` |
| `role-strict` | `yes` or `no` |
| `route-reflector-client` | `yes` or `no` |
| `send-community` | for example `large`, `none`, `standard` |
| `send-learned` | `yes` or `no` |
| `soft-reconfiguration-inbound` | `yes` or `no` |
| `supported-metric` | `yes` or `no` |
| `template` | text |
| `ttl-security` | `yes` or `no` |
| `update-source` | text |
| `weight` | a number |

#### /routing bgp templates

Neighbour templates. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `add-path` | for example `both`, `receive`, `send` |
| `add-path-best` | a number |
| `add-path-limit` | a number |
| `allowas-in` | a number |
| `bfd` | `yes` or `no` |
| `connect-retry` | a number |
| `dampening` | `yes` or `no` |
| `default-originate` | `yes` or `no` |
| `default-originate-map` | text |
| `default-originate-uplinks-fit` | `yes` or `no` |
| `enabled` | `yes` or `no` |
| `enforce-first-as` | `yes` or `no` |
| `engine` | for example `native` |
| `export-map` | text |
| `export-prefix-list` | text |
| `graceful-shutdown` | `yes` or `no` |
| `hold-time` | a number |
| `import-map` | text |
| `import-prefix-list` | text |
| `install-routes` | `yes` or `no` |
| `instance` | text |
| `keepalive` | several words, quoted |
| `local-as` | a number |
| `max-prefix` | a number |
| `max-prefix-action` | for example `restart`, `warn` |
| `multihop` | a number |
| `neighbor` | text |
| `next-hop-self` | `yes` or `no` |
| `passive` | `yes` or `no` |
| `password` | text |
| `redistribute` | for example `bgp`, `connected`, `ospf`, `static` |
| `remote-as` | a number |
| `remove-private-as` | `yes` or `no` |
| `role` | for example `customer`, `peer`, `provider`, `rs`, `rs-client` |
| `role-strict` | `yes` or `no` |
| `route-reflector-client` | `yes` or `no` |
| `send-community` | for example `large`, `none`, `standard` |
| `send-learned` | `yes` or `no` |
| `soft-reconfiguration-inbound` | `yes` or `no` |
| `supported-metric` | `yes` or `no` |
| `template` | text |
| `ttl-security` | `yes` or `no` |
| `update-source` | text |
| `weight` | a number |

#### /routing bgp networks

Announced networks. Available on: NR642, NAP612, vNR.

A list: `add prefix=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

#### /routing bgp aggregates

Aggregates. Available on: NR642, NAP612, vNR.

A list: `add prefix=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `as-set` | `yes` or `no` |
| `matching-med-only` | `yes` or `no` |
| `route-map` | text |
| `summary-only` | `yes` or `no` |

#### /routing bgp rpki

RPKI caches. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `<name>.address` | text |
| `<name>.expire` | a number |
| `<name>.port` | a number |
| `<name>.preference` | a number |
| `<name>.refresh` | a number |
| `<name>.retry` | a number |
| `<name>.transport` | for example `ssh`, `tls` |

#### /routing bgp damping

Route flap damping. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`.

| setting | value |
|---|---|
| `half-life` | a number |
| `max-suppress` | a number |
| `reuse` | a number |
| `suppress` | a number |

#### /routing bgp sessions

BGP sessions. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`. Not in the CLI in this release (the WebUI has them): `clear`.

#### /routing bgp routes

BGP's routes. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /routing filters prefix-lists

Prefix lists. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `<name>.action` | for example `deny`, `permit` |
| `<name>.ge` | a number |
| `<name>.le` | a number |
| `<name>.prefix` | text |

#### /routing filters route-maps

Route maps. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `<name>.action` | for example `deny`, `permit` |
| `<name>.call` | text |
| `<name>.description` | text |
| `<name>.match-as-path` | text |
| `<name>.match-community` | text |
| `<name>.match-local-pref` | a number |
| `<name>.match-med` | a number |
| `<name>.match-next-hop` | text |
| `<name>.match-origin` | for example `egp`, `igp`, `incomplete` |
| `<name>.match-peer` | text |
| `<name>.match-prefix-list` | text |
| `<name>.match-rpki` | for example `invalid`, `notfound`, `valid` |
| `<name>.match-source-protocol` | for example `bgp`, `connected`, `ospf`, `static` |
| `<name>.on-match` | for example `next` |
| `<name>.on-match.goto` | a number |
| `<name>.set-as-path-exclude` | a number |
| `<name>.set-as-path-prepend` | a number |
| `<name>.set-as-path-prepend-last-as` | a number |
| `<name>.set-community` | text |
| `<name>.set-community-delete` | text |
| `<name>.set-community-replace` | `yes` or `no` |
| `<name>.set-local-pref` | a number |
| `<name>.set-med` | a number |
| `<name>.set-metric` | a number |
| `<name>.set-metric-type` | a number |
| `<name>.set-next-hop` | text |
| `<name>.set-origin` | for example `egp`, `igp`, `incomplete` |
| `<name>.set-tag` | a number |
| `<name>.set-weight` | a number |

#### /routing filters community-lists

Community lists. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `match-all` | `yes` or `no` |
| `member` | text |

#### /routing filters as-path-lists

AS-path lists. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `<name>.action` | for example `deny`, `permit` |
| `<name>.pattern` | text |

**Examples.** A configuration under /routing, as `export` prints it:

```
/routing static
add name=lab destination=10.50.0.0/16 gateway=192.168.88.2
```

```
[admin@r1] > /routing static add name=backup destination=10.60.0.0/16 gateway=192.168.88.3
```

### /monitoring

Traffic, flows, neighbours, logs, diagnostics.

#### /monitoring traffic

Traffic per interface. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /monitoring flows

Live flows. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /monitoring neighbours

The ARP and neighbour table. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /monitoring network-discovery

LLDP, CDP and MNDP per interface. Available on: NR642, NAP612, vNR.

A list: `add interface=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `enabled` | `yes` or `no` |

#### /monitoring logs

The log. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /monitoring logs servers

Remote syslog. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `address` | text |
| `description` | text |
| `enabled` | `yes` or `no` |
| `exclude-topic` | text |
| `facility` | text |
| `format` | for example `rfc3164`, `rfc5424` |
| `port` | a number |
| `protocol` | for example `tcp`, `tls`, `udp` |
| `severity` | text |
| `source-address` | text |
| `tls-ca` | text |
| `tls-fingerprint` | text |
| `topic` | text |
| `vrf` | text |

#### /monitoring diagnostics

Ping, traceroute, DNS. Available on: NR642, NAP612, vNR.

No settings of its own. Commands: `ping`, `traceroute`, `dns-lookup`.

- `ping`: `ping <address> [count=N] [size=BYTES] [vrf=NAME | src-address=ADDRESS]`: until Ctrl-C at a terminal, four in a script.
- `traceroute`: `traceroute <address> [max-hops=N] [vrf=NAME | src-address=ADDRESS]`: twenty hops by default.
- `dns-lookup`: `dns-lookup <name> [server=ADDRESS]`.

#### /monitoring diagnostics bandwidth-test

The bandwidth test. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`. Not in the CLI in this release (the WebUI has them): `run`, `stop`, `status`.

| setting | value |
|---|---|
| `authenticate` | `yes` or `no` |
| `client` | `yes` or `no` |
| `max-sessions` | a number |
| `server` | `yes` or `no` |

#### /monitoring diagnostics bandwidth-test users

Who may test against this unit. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `enabled` | `yes` or `no` |

**Examples.** A configuration under /monitoring, as `export` prints it:

```
/monitoring logs servers
add name=siem address=192.168.88.9 protocol=udp
```

```
[admin@r1] > /monitoring logs servers set siem protocol=tcp
```

### /system

Settings, users, firmware, services, SNMP, history.

#### /system identity

The unit's name. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`.

| setting | value |
|---|---|
| `hostname` | text |

#### /system settings

Time, SSH, the WebUI. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`.

| setting | value |
|---|---|
| `ipv6-ula` | `yes` or `no` |
| `led` | for example `off` |
| `led.schedule` | several words, quoted |
| `mdns-enabled` | `yes` or `no` |
| `ntp.server` | text |
| `ntp.source` | for example `manual` |
| `ssh-enabled` | `yes` or `no` |
| `ssh-key-only` | `yes` or `no` |
| `timezone` | text |
| `webui.allowed-host` | text |
| `webui.https` | `yes` or `no` |

#### /system configuration

Commit mode, rescue, lock. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`. Not in the CLI in this release (the WebUI has them): `rescue`, `lock`.

| setting | value |
|---|---|
| `commit-mode` | for example `review` |

#### /system ssh-keys

Your SSH keys. Available on: NR642, NAP612, vNR.

No settings of its own. Commands: . Not in the CLI in this release (the WebUI has them): `show`, `add`, `remove`.

#### /system backup

The configuration as a file. Available on: NR642, NAP612, vNR.

No settings of its own. Commands: . Not in the CLI in this release (the WebUI has them): `save`, `load`.

#### /system reset-configuration

The factory configuration. Available on: NR642, NAP612, vNR.

No settings of its own. Commands: . Not in the CLI in this release (the WebUI has them): `reset`.

#### /system firmware

The firmware. Available on: NR642, NAP612, vNR.

No settings of its own. Commands: `show`, `status`, `confirm`, `rollback`. Not in the CLI in this release (the WebUI has them): `check`, `install`.

- `show`: the version and image that run, and a trial's state and seconds left.
- `status`: the same as `show`.
- `confirm`: keeps the firmware on trial, recorded with the SSH client's address or as the console.
- `rollback`: asks first, then rolls a trial back or cancels an armed upgrade (the unit restarts).

#### /system reboot

Restart the unit. Available on: NR642, NAP612, vNR.

No settings of its own. Commands: `reboot`.

- `reboot`: asks `Reboot, yes? [y/N]` and restarts the unit on a yes; refused during a firmware trial.

#### /system shutdown

Power the virtual router off. Available on: vNR.

No settings of its own. Commands: . Not in the CLI in this release (the WebUI has them): `shutdown`.

#### /system resources

CPU, memory, uptime. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /system cloud

Cloud management. Available on: NR642, NAP612, vNR.

No settings of its own. Commands: . Not in the CLI in this release (the WebUI has them): `show`, `set`.

#### /system users

Accounts. Available on: NR642, NAP612, vNR.

No settings of its own. Commands: . Not in the CLI in this release (the WebUI has them): `show`, `add`, `remove`, `set`.

#### /system password

Change your password. Available on: NR642, NAP612, vNR.

No settings of its own. Commands: . Not in the CLI in this release (the WebUI has them): `password`.

#### /system history

Every commit: who, when, by what. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`. Not in the CLI in this release (the WebUI has them): `rollback`.

#### /system licences

The licences. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /system terms

The terms of use. Available on: NR642, NAP612, vNR.

What runs, read-only. Commands: `show`.

#### /system usb

USB storage, where the router has it. Available on: NR642, NAP612, vNR.

No settings of its own. Commands: . Not in the CLI in this release (the WebUI has them): `show`, `backup`.

#### /system remote-services

The unit's own services and who may reach them. Available on: NR642, NAP612, vNR.

The unit's own items (`name`): `set`, never added or removed. Commands: `show`, `set`, `unset`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `available-from` | for example `2026-01-01T00:00:10Z`, `2026-01-01T00:00:11Z`, `2026-01-01T00:00:12Z`, `2026-01-01T00:00:13Z`, `2026-01-01T00:00:14Z` |
| `enabled` | `yes` or `no` |
| `guard.ban` | a number |
| `guard.enabled` | `yes` or `no` |
| `guard.failures` | a number |
| `guard.window` | a number |
| `http-redirect` | `yes` or `no` |
| `port` | a number |

#### /system snmp

SNMP. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `community` | text |
| `contact` | text |
| `enabled` | `yes` or `no` |
| `location` | text |
| `v2c` | `yes` or `no` |

#### /system snmp users

SNMPv3 users. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `auth` | for example `md5`, `none`, `sha`, `sha-384`, `sha-512` |
| `enabled` | `yes` or `no` |
| `privacy` | for example `des`, `none` |

#### /system snmp traps

Trap receivers. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `address` | text |
| `community` | text |
| `enabled` | `yes` or `no` |
| `inform` | `yes` or `no` |
| `port` | a number |
| `user` | text |
| `version` | for example `v3` |

#### /system traffic-flow

NetFlow/IPFIX export. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `` | a flag: the word alone |
| `active-timeout` | a number |
| `enabled` | `yes` or `no` |
| `inactive-timeout` | a number |
| `interface` | text |
| `sampling-interval` | a number |
| `zone` | text |

#### /system traffic-flow collectors

Collectors. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`.

| setting | value |
|---|---|
| `address` | text |
| `description` | text |
| `domain-id` | a number |
| `enabled` | `yes` or `no` |
| `format` | for example `ipfix`, `v5`, `v9` |
| `message-size` | a number |
| `port` | a number |
| `source` | text |
| `template-refresh` | a number |
| `template-refresh-packets` | a number |

#### /system radius

RADIUS. Available on: NR642, NAP612, vNR.

One set of settings: `set key=value`. Commands: `show`, `set`, `unset`, `get`.

| setting | value |
|---|---|
| `admin-login` | `yes` or `no` |
| `coa-port` | a number |
| `dead-time` | a number |
| `interim-interval` | a number |
| `nas-identifier` | text |
| `nas-ip-address` | text |

#### /system radius servers

RADIUS servers, in order. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`, `enable`, `disable`. `move` is not in the CLI in this release: set `order=`.

| setting | value |
|---|---|
| `acct-port` | a number |
| `address` | text |
| `auth-port` | a number |
| `coa` | `yes` or `no` |
| `enabled` | `yes` or `no` |
| `order` | a number |
| `require-message-authenticator` | `yes` or `no` |
| `retries` | a number |
| `secret` | text |
| `source-address` | text |
| `timeout` | a number |

#### /system certificates

Certificates. Available on: NR642, NAP612, vNR.

A list: `add name=...`, then each item by number, name or `[find ...]`. Commands: `show`, `add`, `set`, `unset`, `remove`, `get`.

| setting | value |
|---|---|
| `crl-http` | `yes` or `no` |
| `crl-url` | text |
| `days-valid` | a number |
| `dns` | text |
| `ip` | text |

#### /system support-output

A support file. Available on: NR642, NAP612, vNR.

No settings of its own. Commands: . Not in the CLI in this release (the WebUI has them): `save`.

**Examples.** A configuration under /system, as `export` prints it:

```
/system identity
set hostname=r1
/system settings
set ntp.source=manual ntp.server=pool.ntp.org
/system remote-services
set ssh port=2222
/system snmp
set enabled=yes location="Floor 2"
```

```
[admin@r1] > /system identity set hostname=branch-1
```

```
[admin@r1] > /system snmp set location="Floor 3"
```